CVE WatchJul 23, 2026

CVE-2025-71389

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose R

CVSS

10.0

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Jul 23, 2026 · Last modified: Jul 23, 2026 · CWE-94

EPSS · 30d

Not enough EPSS history yet.

Technical description

Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-601227.8 HIG

—

———gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites[].used field, which is inserted unsanitized into a gnuplot heredoc data block. Attackers can supply a used value containing the string EOD to terminate the heredoc early and append gnuplot system() calls, achieving OS command execution as the user running gpsprof when the generated plot script is processed by gnuplot in polar mode.7h CVE-2026-47722—

—

———nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent's `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.7h CVE-2026-4766810.0 CRI

—

———DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.8h CVE-2026-659079.1 CRI

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible12h CVE-2026-659068.8 HIG

—

———In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible12h CVE-2026-648158.1 HIG

—

——0In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files13h